# Vulnerabilities published in 2026


- [MAL-2026-5468](https://insights.sbomify.com/MAL-2026-5468/): Malicious code in getd-pantallas-cliente (npm) (malicious package)
- [MAL-2026-5467](https://insights.sbomify.com/MAL-2026-5467/): Malicious code in getd-handler-api (npm) (malicious package)
- [MAL-2026-5466](https://insights.sbomify.com/MAL-2026-5466/): Malicious code in getd-eslint-rules (npm) (malicious package)
- [MAL-2026-5465](https://insights.sbomify.com/MAL-2026-5465/): Malicious code in getd-content-management (npm) (malicious package)
- [MAL-2026-5464](https://insights.sbomify.com/MAL-2026-5464/): Malicious code in db-xorma (npm) (malicious package)
- [MAL-2026-5463](https://insights.sbomify.com/MAL-2026-5463/): Malicious code in db-dx-connector (npm) (malicious package)
- [MAL-2026-5462](https://insights.sbomify.com/MAL-2026-5462/): Malicious code in @rockawayx/utils (npm) (malicious package)
- [MAL-2026-5461](https://insights.sbomify.com/MAL-2026-5461/): Malicious code in fhirproxy-utils (npm) (malicious package)
- [MAL-2026-5460](https://insights.sbomify.com/MAL-2026-5460/): Malicious code in fhirproxy (npm) (malicious package)
- [MAL-2026-546](https://insights.sbomify.com/MAL-2026-546/): Malicious code in xhjxhjhiagent (npm) (malicious package)
- [MAL-2026-5459](https://insights.sbomify.com/MAL-2026-5459/): Malicious code in @dktunited/anly-tracker-v2 (npm) (malicious package)
- [MAL-2026-5458](https://insights.sbomify.com/MAL-2026-5458/): Malicious code in ultimate-ai-power (PyPI) (malicious package)
- [MAL-2026-5457](https://insights.sbomify.com/MAL-2026-5457/): Malicious code in tao-subnet-metrics (PyPI) (malicious package)
- [MAL-2026-5456](https://insights.sbomify.com/MAL-2026-5456/): Malicious code in via-city-tools-m-particle (npm) (malicious package)
- [MAL-2026-5455](https://insights.sbomify.com/MAL-2026-5455/): Malicious code in uipath-sugar-sell (npm) (malicious package)
- [MAL-2026-5454](https://insights.sbomify.com/MAL-2026-5454/): Malicious code in ui-ng-components (npm) (malicious package)
- [MAL-2026-5453](https://insights.sbomify.com/MAL-2026-5453/): Malicious code in tivo-codelib-a (npm) (malicious package)
- [MAL-2026-5452](https://insights.sbomify.com/MAL-2026-5452/): Malicious code in shopify-app-bridge-internal (npm) (malicious package)
- [MAL-2026-5451](https://insights.sbomify.com/MAL-2026-5451/): Malicious code in privacy-sdk (npm) (malicious package)
- [MAL-2026-5450](https://insights.sbomify.com/MAL-2026-5450/): Malicious code in o3forms (npm) (malicious package)
- [MAL-2026-545](https://insights.sbomify.com/MAL-2026-545/): Malicious code in testxhjhka (npm) (malicious package)
- [MAL-2026-5449](https://insights.sbomify.com/MAL-2026-5449/): Malicious code in morningstar-design-system (npm) (malicious package)
- [MAL-2026-5448](https://insights.sbomify.com/MAL-2026-5448/): Malicious code in mazemap (npm) (malicious package)
- [MAL-2026-5447](https://insights.sbomify.com/MAL-2026-5447/): Malicious code in localization-lib (npm) (malicious package)
- [MAL-2026-5446](https://insights.sbomify.com/MAL-2026-5446/): Malicious code in housecall-ui (npm) (malicious package)
- [MAL-2026-5445](https://insights.sbomify.com/MAL-2026-5445/): Malicious code in grateful-payments (npm) (malicious package)
- [MAL-2026-5444](https://insights.sbomify.com/MAL-2026-5444/): Malicious code in grateful-checkout (npm) (malicious package)
- [MAL-2026-5443](https://insights.sbomify.com/MAL-2026-5443/): Malicious code in exodus-wallet-core (npm) (malicious package)
- [MAL-2026-5442](https://insights.sbomify.com/MAL-2026-5442/): Malicious code in exodus-solana-sdk (npm) (malicious package)
- [MAL-2026-5441](https://insights.sbomify.com/MAL-2026-5441/): Malicious code in exodus-secure-container (npm) (malicious package)
- [MAL-2026-5440](https://insights.sbomify.com/MAL-2026-5440/): Malicious code in exodus-ethereum-sdk (npm) (malicious package)
- [MAL-2026-544](https://insights.sbomify.com/MAL-2026-544/): Malicious code in testxhjhk (npm) (malicious package)
- [MAL-2026-5439](https://insights.sbomify.com/MAL-2026-5439/): Malicious code in exodus-checkout-signer (npm) (malicious package)
- [MAL-2026-5438](https://insights.sbomify.com/MAL-2026-5438/): Malicious code in corporate-front-vue (npm) (malicious package)
- [MAL-2026-5437](https://insights.sbomify.com/MAL-2026-5437/): Malicious code in commons-ui-styles (npm) (malicious package)
- [MAL-2026-5436](https://insights.sbomify.com/MAL-2026-5436/): Malicious code in checkout-signer (npm) (malicious package)
- [MAL-2026-5435](https://insights.sbomify.com/MAL-2026-5435/): Malicious code in ac_semantic-ui_ts (npm) (malicious package)
- [MAL-2026-5434](https://insights.sbomify.com/MAL-2026-5434/): Malicious code in ac_calendar_ts (npm) (malicious package)
- [MAL-2026-5433](https://insights.sbomify.com/MAL-2026-5433/): Malicious code in @webda-infra/search (npm) (malicious package)
- [MAL-2026-5432](https://insights.sbomify.com/MAL-2026-5432/): Malicious code in @webda-features/dashboard (npm) (malicious package)
- [MAL-2026-5431](https://insights.sbomify.com/MAL-2026-5431/): Malicious code in @webd-infra/query-designer-domain (npm) (malicious package)
- [MAL-2026-5430](https://insights.sbomify.com/MAL-2026-5430/): Malicious code in @sourceflow-uk/sourceflow-tracker (npm) (malicious package)
- [MAL-2026-543](https://insights.sbomify.com/MAL-2026-543/): Malicious code in tailwind-components-cli (npm) (malicious package)
- [MAL-2026-5429](https://insights.sbomify.com/MAL-2026-5429/): Malicious code in @shell-landing/routes (npm) (malicious package)
- [MAL-2026-5428](https://insights.sbomify.com/MAL-2026-5428/): Malicious code in @shell-cabinet/routes (npm) (malicious package)
- [MAL-2026-5427](https://insights.sbomify.com/MAL-2026-5427/): Malicious code in @payment-review/store (npm) (malicious package)
- [MAL-2026-5426](https://insights.sbomify.com/MAL-2026-5426/): Malicious code in @oplus/obus-web-sdk-plugin-recovery (npm) (malicious package)
- [MAL-2026-5425](https://insights.sbomify.com/MAL-2026-5425/): Malicious code in @oplus/obus-web-sdk (npm) (malicious package)
- [MAL-2026-5424](https://insights.sbomify.com/MAL-2026-5424/): Malicious code in @oplus/obus-core (npm) (malicious package)
- [MAL-2026-5423](https://insights.sbomify.com/MAL-2026-5423/): Malicious code in @nstrlabs/utils (npm) (malicious package)
- [MAL-2026-5422](https://insights.sbomify.com/MAL-2026-5422/): Malicious code in @nstrlabs/shared-components (npm) (malicious package)
- [MAL-2026-5421](https://insights.sbomify.com/MAL-2026-5421/): Malicious code in @nstrlabs/sdk (npm) (malicious package)
- [MAL-2026-5420](https://insights.sbomify.com/MAL-2026-5420/): Malicious code in @nstrlabs/ixel (npm) (malicious package)
- [MAL-2026-542](https://insights.sbomify.com/MAL-2026-542/): Malicious code in stylus.js (npm) (malicious package)
- [MAL-2026-5419](https://insights.sbomify.com/MAL-2026-5419/): Malicious code in @nstrlabs/auth (npm) (malicious package)
- [MAL-2026-5418](https://insights.sbomify.com/MAL-2026-5418/): Malicious code in @nstrlabs/api-client (npm) (malicious package)
- [MAL-2026-5417](https://insights.sbomify.com/MAL-2026-5417/): Malicious code in @klapp-sca/routes (npm) (malicious package)
- [MAL-2026-5416](https://insights.sbomify.com/MAL-2026-5416/): Malicious code in @klapp-otp/routes (npm) (malicious package)
- [MAL-2026-5415](https://insights.sbomify.com/MAL-2026-5415/): Malicious code in @klapp-login-platform/routes (npm) (malicious package)
- [MAL-2026-5414](https://insights.sbomify.com/MAL-2026-5414/): Malicious code in @klapp-login-platform/oidc (npm) (malicious package)
- [MAL-2026-5413](https://insights.sbomify.com/MAL-2026-5413/): Malicious code in @klapp-login-platform/native-sdk (npm) (malicious package)
- [MAL-2026-5412](https://insights.sbomify.com/MAL-2026-5412/): Malicious code in @klapp-kyc/routes (npm) (malicious package)
- [MAL-2026-5411](https://insights.sbomify.com/MAL-2026-5411/): Malicious code in @klapp-about/routes (npm) (malicious package)
- [MAL-2026-5410](https://insights.sbomify.com/MAL-2026-5410/): Malicious code in @easy-entry/routes (npm) (malicious package)
- [MAL-2026-541](https://insights.sbomify.com/MAL-2026-541/): Malicious code in pump.js (npm) (malicious package)
- [MAL-2026-5409](https://insights.sbomify.com/MAL-2026-5409/): Malicious code in @easy-entry/outside-registration-fop-navigator (npm) (malicious package)
- [MAL-2026-5408](https://insights.sbomify.com/MAL-2026-5408/): Malicious code in @easy-entry/landing-routes (npm) (malicious package)
- [MAL-2026-5407](https://insights.sbomify.com/MAL-2026-5407/): Malicious code in @card-pci-data/store (npm) (malicious package)
- [MAL-2026-5406](https://insights.sbomify.com/MAL-2026-5406/): Malicious code in ui-weave (npm) (malicious package)
- [MAL-2026-5405](https://insights.sbomify.com/MAL-2026-5405/): Malicious code in comos-sdk (npm) (malicious package)
- [MAL-2026-5404](https://insights.sbomify.com/MAL-2026-5404/): Malicious code in cubifyanything (PyPI) (malicious package)
- [MAL-2026-5403](https://insights.sbomify.com/MAL-2026-5403/): Malicious code in t-invest-mcp-server (npm) (malicious package)
- [MAL-2026-5402](https://insights.sbomify.com/MAL-2026-5402/): Malicious code in screenpipe-mcp-http (npm) (malicious package)
- [MAL-2026-5401](https://insights.sbomify.com/MAL-2026-5401/): Malicious code in savant-listing (npm) (malicious package)
- [MAL-2026-5400](https://insights.sbomify.com/MAL-2026-5400/): Malicious code in multica (npm) (malicious package)
- [MAL-2026-540](https://insights.sbomify.com/MAL-2026-540/): Malicious code in n8n-nodes-xkwqpzrt-jmflhvbn-dsyocgxwmkelpt (npm) (malicious package)
- [MAL-2026-54](https://insights.sbomify.com/MAL-2026-54/): Malicious code in lium-4-96 (PyPI) (malicious package)
- [MAL-2026-5399](https://insights.sbomify.com/MAL-2026-5399/): Malicious code in kraken-ui (npm) (malicious package)
- [MAL-2026-5398](https://insights.sbomify.com/MAL-2026-5398/): Malicious code in hey-base32 (npm) (malicious package)
- [MAL-2026-5397](https://insights.sbomify.com/MAL-2026-5397/): Malicious code in create-docs-mcp (npm) (malicious package)
- [MAL-2026-5396](https://insights.sbomify.com/MAL-2026-5396/): Malicious code in @sqlite-node/createsql (npm) (malicious package)
- [MAL-2026-5395](https://insights.sbomify.com/MAL-2026-5395/): Malicious code in @sql-trigger/nodesql (npm) (malicious package)
- [MAL-2026-5394](https://insights.sbomify.com/MAL-2026-5394/): Malicious code in @sql-access/nodesql (npm) (malicious package)
- [MAL-2026-5393](https://insights.sbomify.com/MAL-2026-5393/): Malicious code in @sflyinc-knapsack/shutterfly-react (npm) (malicious package)
- [MAL-2026-5392](https://insights.sbomify.com/MAL-2026-5392/): Malicious code in @open-banking/cabinet-providers (npm) (malicious package)
- [MAL-2026-5391](https://insights.sbomify.com/MAL-2026-5391/): Malicious code in @0xlr/vercel-analytics (npm) (malicious package)
- [MAL-2026-5390](https://insights.sbomify.com/MAL-2026-5390/): Malicious code in @0xlr/supabase-db (npm) (malicious package)
- [MAL-2026-539](https://insights.sbomify.com/MAL-2026-539/): Malicious code in n8n-nodes-gg-udhasudsh-hgjkhg-official (npm) (malicious package)
- [MAL-2026-5389](https://insights.sbomify.com/MAL-2026-5389/): Malicious code in @0xlr/stripe-frontend (npm) (malicious package)
- [MAL-2026-5388](https://insights.sbomify.com/MAL-2026-5388/): Malicious code in @0xlr/stripe-checkout-js (npm) (malicious package)
- [MAL-2026-5387](https://insights.sbomify.com/MAL-2026-5387/): Malicious code in @0xlr/sentry-web (npm) (malicious package)
- [MAL-2026-5386](https://insights.sbomify.com/MAL-2026-5386/): Malicious code in @0xlr/prisma-client-js (npm) (malicious package)
- [MAL-2026-5385](https://insights.sbomify.com/MAL-2026-5385/): Malicious code in @0xlr/clerk-auth (npm) (malicious package)
- [MAL-2026-5384](https://insights.sbomify.com/MAL-2026-5384/): Malicious code in enquriers (npm) (malicious package)
- [MAL-2026-5383](https://insights.sbomify.com/MAL-2026-5383/): Malicious code in @doaction/wasm-loader (npm) (malicious package)
- [MAL-2026-5382](https://insights.sbomify.com/MAL-2026-5382/): Malicious code in @doaction/types (npm) (malicious package)
- [MAL-2026-5381](https://insights.sbomify.com/MAL-2026-5381/): Malicious code in @doaction/systeminformation (npm) (malicious package)
- [MAL-2026-5380](https://insights.sbomify.com/MAL-2026-5380/): Malicious code in @doaction/sudo-prompt (npm) (malicious package)
- [MAL-2026-538](https://insights.sbomify.com/MAL-2026-538/): Malicious code in n8n-nodes-gasdhgfuy-rejerw-ytjsadx (npm) (malicious package)
- [MAL-2026-5379](https://insights.sbomify.com/MAL-2026-5379/): Malicious code in @doaction/storage (npm) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/60/